EUVD-2026-45877
GHSA-9cgw-w9ww-cvhp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the prerequisite of posting a review on the connected third-party platform; PR:N is correct as no WordPress-side account is needed; C:L/I:L captures the bounded, shortcode-dependent impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source.
AnalysisAI
Shortcode injection in the Reviews Feed WordPress plugin before 2.6.5 allows unauthenticated network attackers to execute arbitrary WordPress shortcodes on any site page that renders the affected feed. The attack is indirect: an adversary plants a shortcode payload inside a review on a connected third-party review platform (e.g., a Google Business profile linked to the plugin); when the plugin ingests and renders that review through its dynamic block without neutralizing shortcode syntax, WordPress's native shortcode processor executes the embedded macro. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in CISA KEV, though the public POC meaningfully elevates practical risk above what the moderate CVSS score of 4.8 suggests.
Technical ContextAI
Reviews Feed is a WordPress plugin that aggregates reviews from external platforms (Google, Yelp, etc.) and displays them via a Gutenberg dynamic block. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): the plugin ingests third-party review text and passes it to WordPress's rendering pipeline without stripping or escaping shortcode delimiters before the block is rendered. WordPress's do_shortcode() function processes any bracket-delimited macro it encounters, regardless of the content's origin, so review text containing [some-shortcode] is treated as a legitimate shortcode invocation. The affected CPE is cpe:2.3:a:unknown:reviews_feed:*:*:*:*:*:*:*:* covering all versions from 0 up to (not including) 2.6.5. The effective impact at execution time depends heavily on which shortcodes are registered by other installed plugins on the target site - a site running form, file-access, or authentication shortcodes exposes a wider blast radius than one with only presentational shortcodes.
RemediationAI
Update the Reviews Feed WordPress plugin to version 2.6.5 or later, which is confirmed as the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/7def5cf4-655d-424b-b1fc-eb333465434e/. This is the primary and most effective fix. If immediate update is blocked, disconnect all third-party review sources from the plugin to prevent malicious review content from being ingested - note this disables the plugin's core functionality. Alternatively, deactivating the plugin entirely removes the attack surface with no side effects beyond loss of the reviews feed display. Restricting shortcode registration site-wide (via a remove_shortcode() filter for non-essential shortcodes) reduces the potential impact of any shortcode executed but may break legitimate plugin functionality and is not a substitute for patching. A WAF rule blocking bracket-delimited shortcode patterns in dynamically rendered block output is an additional compensating layer but risks false positives on legitimate content.
More in Reviews Feed
View allThe Reviews Feed - Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for Wor
The Reviews Feed - Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for Wor
Share
External POC / Exploit Code
Leaving vuln.today